Privacy Policy

ghladmin (the "Service") is operated by Voxility ("we", "us"). This policy explains what we collect, why, where it lives, and how to exercise your rights. Contact for anything privacy related: ryan@growthable.io.

Account information. Your name, email address, and authentication credentials when you create an account.

CRM connection credentials. When you connect a CRM sub-account via OAuth, we store the access and refresh tokens needed to act on your behalf. Tokens are stored encrypted and refreshed automatically.

CRM data, viewed live. Contacts, opportunities, pipelines, custom fields, custom values, tags, and users are fetched from the CRM API when you view them. We do not keep a background copy of your CRM database. We store limited derived records where a feature requires it: daily aggregate location metrics (counts, not contact records), forecast category assignments, and the membership records described below.

Data collected through your forms and kiosks. When your customers submit a form, sign a waiver, or check in at a kiosk you operate, we store that submission on your behalf: answers, contact details (name, email, phone), signature images, consent timestamps, membership balances, and check-in history. For this data you are the controller and we are a processor — we process it only to provide the Service to you.

Advertising data (optional). If you connect a Meta ad account, we store the OAuth token and campaign performance metrics you choose to sync.

Usage data. Standard technical logs (IP address, browser, pages viewed) used for security and to operate the Service. Public forms record anonymous funnel events (view, start, complete) tied to a random session identifier, not to advertising profiles.

• To provide and operate the Service — its only purpose.
• To write data back to your CRM when you ask it to (form submissions, tags, membership state).
• To secure the Service and prevent abuse.
• To respond to support requests.

We do not sell personal information, we do not share it for cross-context behavioural advertising, and we do not use your Customer Data to train machine-learning models.

The Service is hosted on Vercel, with data stored in Supabase (PostgreSQL and object storage). Signature images are stored in a dedicated storage bucket. Connected third-party platforms (the CRM provider; Meta if you connect it) process data under their own privacy policies.

Account and configuration data is kept while your account is active. OAuth tokens are deleted when you disconnect a location or uninstall the app. Form submissions, signatures, and membership records are kept until you delete them in the Service or ask us to remove them.

To request deletion of your account or any data we hold — including data subjects exercising rights against data you collected through the Service — email ryan@growthable.io. We action deletion requests within 30 days and confirm when complete.

Depending on where you live (including under the GDPR and the CCPA/CPRA), you may have the right to access, correct, export, restrict, or delete personal information we hold about you, and to not be discriminated against for exercising those rights. Send requests to the email above; we will verify and respond within the timeframe required by the applicable law.

Access to production data is restricted and authenticated. CRM tokens are stored encrypted, database access is governed by row-level security so each account can only reach its own records, and all traffic is served over TLS. No system is perfectly secure; if we become aware of a breach affecting your data we will notify you without undue delay.

The Service is a business tool and is not directed at children under 16. We do not knowingly collect their data as account holders.

We may update this policy; material changes will be notified through the Service or by email before they take effect. The effective date above always reflects the current version.

Privacy questions or requests: ryan@growthable.io · +1 541-391-5229. See also our Terms & Conditions.